Alert GCSA-26236 - Vulnerabilita' critiche in prodotti Citrix

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** Alert ID: GCSA-26236 Data: 28 settembre 2026 Titolo: Vulnerabilita' critiche in prodotti Citrix ****************************************************************** :: Descrizione del problema Citrix ha rilasciato nuove versioni dei suoi prodotti per risolvere 8 vulnerabilita', delle quali 3 sono di livello "critico" e 5 di livello "alto". Inoltre le seguenti vulnerabilita' risultano in corso di sfruttamento: CVE-2026-88771 (CVSS v4.0 score 9.5) errata convalida di input utente, puo' consentire ad un aggressore remoto non autenticato di eseguire comandi arbitrari. CVE-2026-88772 (CVSS v4.0 score 9.5) vulnerabilita' di tipo overflow della memoria, puo' consentire l'esecuzione di codice remoto o denial of service. Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato NetScaler ADC and NetScaler Gateway version before 14.1-73.37 NetScaler ADC and NetScaler Gateway version before 13.1-64.23 NetScaler ADC FIPS before 14.1-73.37 FIPS NetScaler ADC FIPS and NDcPP before 13.1-37.279 :: Impatto Denial of Service (DoS) Esecuzione remota di comandi o codice arbitrario (RCE) Rivelazione di informazioni (ID) Bypass delle funzionalita' di sicurezza (SFB) :: Soluzioni Aggiornare i prodotti alle ultime versioni. https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance.html https://docs.netscaler.com/en-us/citrix-adc/current-release/upgrade-downgrade-citrix-adc-appliance/upgrade-standalone-appliance.html https://support.citrix.com/external/article/CTX691210/netscaler-upgrades-and-general-configura.html https://www.citrix.com/downloads/citrix-adc/ Steps to Take if NetScaler ADC is Suspected to be Compromised https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html :: Riferimenti Citrix Security Bulletin https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 https://community.citrix.com/techzone-blogs/110_security-updates/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778/ Bleeping Computer https://www.bleepingcomputer.com/news/security/citrix-admins-warned-to-shut-down-netscalers-over-2-exploited-zero-days/ The Hacker News https://thehackernews.com/2026/09/warning-two-unpatched-citrix-netscaler.html Canadian Centre for Cyber Security https://www.cyber.gc.ca/en/alerts-advisories/al26-024-critical-vulnerabilities-affecting-citrix-netscaler-adc-netscaler-gateway-cve-2026-88771-cve-2026-88772 CVE ID https://www.cve.org/CVERecord?id=CVE-2026-88771 https://www.cve.org/CVERecord?id=CVE-2026-88772 https://www.cve.org/CVERecord?id=CVE-2026-88773 https://www.cve.org/CVERecord?id=CVE-2026-88774 https://www.cve.org/CVERecord?id=CVE-2026-88775 https://www.cve.org/CVERecord?id=CVE-2026-88776 https://www.cve.org/CVERecord?id=CVE-2026-88777 https://www.cve.org/CVERecord?id=CVE-2026-88778 GARR CERT Security Alert - subscribe/unsubscribe: https://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaro97gAKCRDBnEyTZRJg QvO9AKCRg5GGRefTojRxYzexYEuXiQv/kwCfQKqArqwNe2THMK0istDpFDofTQg= =uh4H -----END PGP SIGNATURE-----